A threat actor group has begun a campaign that is relevant to an organization. How can the organization's engineer raise the risk score for corresponding intelligence matches in the applicable…

The correct answer is B. Set the weight of the threat collection to a higher integer. In Splunk Enterprise Security, increasing the threat collection weight raises the resulting risk score for any indicators matched from that collection. This allows the organization to prioritize intelligence associated with active or relevant threat actor campaigns.

Threat Intelligence Integration

Question

A threat actor group has begun a campaign that is relevant to an organization. How can the organization's engineer raise the risk score for corresponding intelligence matches in the applicable threat collection?

Options

ASet the weight of the threat collection to a lower integer.
BSet the weight of the threat collection to a higher integer.
CSet the weight of the threat collection to 0.
DSet the weight of the threat collection to 500.

How the community answered

(26 responses)

A
4% (1)
B
85% (22)
C
4% (1)
D
8% (2)

Explanation

In Splunk Enterprise Security, increasing the threat collection weight raises the resulting risk score for any indicators matched from that collection. This allows the organization to prioritize intelligence associated with active or relevant threat actor campaigns.

Topics

#threat collection weight#risk scoring#threat intelligence tuning#ES threat framework

Community Discussion

No community discussion yet for this question.

Full SPLK-5002 Practice